Analytic rule - time frame

Copper Contributor

Hi all,

 

I need to know if i configure an analytic rule, with "TimeGenerated <= ago(1d)" inside the query, which time frame does it refer to when it is running? 

 

Thanks ! 

2 Replies

@Yasta190 

 

the answer depends on your Log Analytics workspace data retention settings. For example, if you have retention configured for 30 days, then the query results will refer the time range between now-30d and now-1d.

@hspinto 

 

You can always test the datetime information returned, one idea (or use arg_min or arg_max): 

 

| summarize min(TimeGenerated), max(TimeGenerated)